US20140165155A1 - Management of network devices utilizing an authorization token - Google Patents
Management of network devices utilizing an authorization token Download PDFInfo
- Publication number
- US20140165155A1 US20140165155A1 US13/787,522 US201313787522A US2014165155A1 US 20140165155 A1 US20140165155 A1 US 20140165155A1 US 201313787522 A US201313787522 A US 201313787522A US 2014165155 A1 US2014165155 A1 US 2014165155A1
- Authority
- US
- United States
- Prior art keywords
- authorization token
- network device
- service provider
- authorization
- management authority
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000013475 authorization Methods 0.000 title claims abstract description 267
- 238000000034 method Methods 0.000 claims abstract description 31
- 238000004590 computer program Methods 0.000 claims description 15
- 230000006870 function Effects 0.000 claims description 7
- 230000005540 biological transmission Effects 0.000 claims description 6
- 238000004891 communication Methods 0.000 description 11
- 238000005516 engineering process Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 5
- 230000008859 change Effects 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000001413 cellular effect Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 238000013459 approach Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 239000000835 fiber Substances 0.000 description 2
- 230000008520 organization Effects 0.000 description 2
- 239000002245 particle Substances 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/02—Details
- H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
- H04L12/1403—Architecture for metering, charging or billing
- H04L12/1407—Policy-and-charging control [PCC] architecture
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/30—Security of mobile devices; Security of mobile applications
- H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
Definitions
- the present invention relates generally to the management of network devices utilizing an authorization token.
- UICCs universal integrated circuit cards
- MNO mobile network operator
- UICCs are owned, managed, and distributed by a particular mobile network operator (MNO) and are removable from the network device (e.g., a cell phone).
- MNO mobile network operator
- the network device owner needs to remove the UICC and put in a new UICC from the new service provider (e.g., another MNO). This is a costly and time consuming process.
- M2M machine-to-machine
- Embedded universal integrated circuit cards are currently being considered for use in network devices (e.g., cell phones, tablets, M2M devices, etc.) which may reduce costs and eliminates the need to remove and replace UICCs from network devices.
- embedded UICCs eUICCs
- eUICCs embedded universal integrated circuit cards
- network devices e.g., cell phones, tablets, M2M devices, etc.
- embedded UICCs eUICCs
- techniques to prevent unauthorized entities from loading, enabling, disabling, and/or deleting services and profiles need to be addressed as well as techniques to allow authorized entities to enable services and manage profiles. This is pertinent both for user-controlled network devices (e.g., cell phones) as well as M2M devices that a user typically does not physically interact with.
- aspects of the invention may relate to an apparatus, system, and method for the management of network devices utilizing an authorization token.
- an authorization token received from a service provider may be verified using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device. Further, operation privileges may be enforced that are contained in the authorization token.
- FIG. 1 is block diagram of a system in which embodiments of the invention related to the management of network devices utilizing an authorization token may be practiced.
- FIG. 2 is a flow diagram illustrating a process implemented by a network device to utilize an authorization token.
- FIG. 3 is block diagram particularly showing a network device utilizing an authorization token.
- FIG. 1 is a block diagram of a system 100 in which embodiments of the invention may be practiced.
- a network device 102 that includes an interface 103 , a processor 104 , and a memory 105 that may store an authorization credential(s) 110 and an authorization token(s) 114 .
- the processor 104 and the memory 105 may be configured in an embedded universal integrated circuit card (eUICC) 115 .
- eUICC embedded universal integrated circuit card
- the eUICC 115 may include some or all of the components regularly utilized by an UICC.
- processor 104 may execute functions including: generating an authorization token 114 using an authorization credential 110 ; commanding the transmission of the authorization token 114 to a device management authority 118 or to a service provider 134 , 130 (if authorized by the device management authority 118 ) via the network interface (I/F) 103 through a link; verifying the authorization token 114 received back from the service provider 134 , 130 using the authorization credential 110 to determine if the service provider 134 , 130 is authorized to perform requested operations with the network device 102 ; and enforcing operation privileges contained in the authorization token 114 .
- the device management authority 118 generally refers to the owner of the network device 102 or an entity that has the authority to authorize another entity to manage the data or service on the eUICC 115 or the network device 102 .
- network device 102 may be any type of suitable network device (e.g. laptop computer, mobile device, non-mobile device, smart phone, cell phone, tablet, personal digital assistant (PDA), machine-to-machine (M2M) device, personal computer, server computer, etc.) having a processor 104 and a memory 105 to implement the previously described functionality and the hereinafter to be described functionality.
- PDA personal digital assistant
- M2M machine-to-machine
- network device 102 may include a user interface 120 which may be any suitable type of input mechanism, e.g., keyboard, keypad, touch-screen, voice recognition, microphone, etc.
- I/F 103 may be a suitable wireless interface and may include suitable transceiver components (e.g. a wireless transmitter and receiver) to send and receive data over a wireless link or may be a suitable wired interface for connection by a suitable cable, wire, etc. (e.g., a wired link). Therefore, the term links to be hereinafter described may be wireless or wired links.
- network device 102 may include a display device 112 , such as, a commonly used display device that is implemented with a network device.
- an authorization token 114 of a network device 102 may be used to authorize an entity (e.g., a service provider 134 , 130 ) to provide a service for the network device 102 and to specify its operation privileges with the network device, as will be described in detail hereinafter.
- entity e.g., a service provider 134 , 130
- network device 102 may communicate via various links with service providers 134 , 130 .
- a service provider may be a mobile network operator (MNO) 134 .
- MNO mobile network operator
- an authorization credential 110 may be selected and programmed into the memory 105 of the eUICC 115 and an authorization token 114 may also be stored in memory 105 .
- authorization credentials 110 may be at least one of a binary string, a password, a secret key, a public key, or a combination thereof.
- FIG. 2 is a flow diagram illustrating a process 200 to generate and verify an authorization token 114 .
- processor 104 may generate an authorization token 114 that may be based upon an authorization credential 110 .
- processor 104 may command a transmission of the authorization token 114 to a device management authority 118 or to a service provider 134 , 130 if authorized by the device management authority 118 .
- processor 104 may verify the authorization token 114 from the service provider using the authorization credential 110 to determine if the service provider is authorized to perform requested operations with the network device 102 .
- processor 104 may enforce operation privileges contained in the authorization token.
- processor 104 may further execute functions to specify operation privileges associated with services that are allowable from the service provider 134 , 130 that are contained and transmitted in the authorization token 114 .
- operation privileges may include loading, deleting, enabling, or disabling a set of data or services of the service provider 134 , 130 .
- an authorization credential 110 is typically created and stored in the eUICC 115 such that only the device management authority 118 may access it.
- a copy of the authorization credential 306 may be given to the device management authority 118 such that the device management authority 118 may use the authorization credential 306 without access to the network device 102 .
- the manufacturer 307 of the eUICC 115 may create the authorization credential 306 and store it in the eUICC 115 or the network device 102 as shown as authorization credential 110 .
- the authorization credential 306 may also be provided to the device management authority 118 which may hold a copy. Again, the device management authority 118 is considered to be the “owner” of the eUICC 115 and/or the network device 102 .
- the device management authority 118 may generate an authorization token 114 for use by the service provider 134 , 130 .
- the device management authority 118 may authorize the network device 102 to generate the authorization token 114 and transmit it to the service provider 134 , 130 while subscribing to the service from the service provider 134 , 130 .
- the service provider 134 , 130 may transmit the authorization token 114 to its associated subscription manager 119 , 132 . While the subscription manager 119 , 132 is trying to access the network device 102 or the eUICC 115 to manage the service on the eUICC 115 or the network device 102 , it will present the authorization token 114 to the eUICC 115 to prove that it is authorized by the device management authority 118 . The eUICC 115 will use the authorization credential 110 to verify the authorization token 114 and to confirm that the subscription manager 119 , 132 is authorized by the device management authority 118 . Inside the authorization token 114 , the device management authority 118 may specify the operation privileges 117 for the service provider 134 , 130 .
- the authorization token 114 may be created with the device management authority's authorization credential 306 such that only the device management authority 118 can create this authorization token 114 .
- the device management authority 118 needs to authorize a service provider 134 , 130 to access the eUICC 115 (e.g., when the device management authority 118 wants to subscribes to a new service provided by the service provider 134 , 130 )
- network device 102 via I/F 103 transmits the authorization token 114 to the service provider 134 , 130 .
- the device management authority 118 or the network device 102 may transmit the authorization token 114 .
- the service provider 134 , 130 transmits the authorization token 114 to the eUICC 115 of the network device 102 and the eUICC may verify the authorization token using the device management authority's authorization token 114 stored in the eUICC.
- the network device 102 can verify the authorization token 114 from the service provider 134 , 130 using the authorization credential 110 to determine if the service provider is authorized to perform requested operations with the network device.
- the authorization token 114 may be generated outside of the network device 102 , such as by the device management authority 118 using the authorization credential 306 .
- the device management authority 118 may include a copy of the authorization credential 306 (e.g., stored in a secure memory) and may input the authorization credential 306 into a computer program to generate the authorization token 114 . And then the device management authority 118 may transmit the authorization token 114 to the service provider 134 , 130 , as an example, when the authorization token 114 is not transmitted to the service provider by the network device 102 .
- the service provider 134 , 130 may transmit the authorization token 114 to the eUICC 115 directly or via the subscription manager 119 , 132 to prove to the eUICC 115 that the device management authority 118 has authorized the service provider 134 , 130 or the subscription manager 119 , 132 to provide service on the eUICC 115 .
- the device management authority 118 may generate the authorization token 114 , set the operation privileges 117 in the authorization token 114 , and may transmit the authorization token 114 to the service provider 134 , 130 .
- the authorization token 114 may also be directly transmitted by the network device 102 to the service provider 134 , 130 .
- authorization token 114 generation may occur at the network device 102 itself, but authorization token 114 generation may also occur outside the network device 102 .
- the management authority 118 may make a copy of the authorization credential 306 and store it securely. In this way, many network devices 102 may be managed by the device management authority 118 at the same time without accessing each network device 102 .
- the device management authority 118 sets the same authorization credential 110 in many network devices 102 , one authorization token 114 may be used for all the network devices 102 that have the same authorization credential 110 . Further, by having the authorization credential 306 stored outside of the network device 102 , the device management authority 118 can generate the authorization token 114 without having to access/connect to the network device. This may be useful for some use cases in which the network device 102 is deployed remotely and the device management authority 118 has lost access/communication with the network device 102 . In order to activate a new service, the device management authority 118 can use the stored authorization credential 306 to generate an authorization token 114 to give to a new service provider (e.g.
- the MNO 134 MNO 134 to load an operational profile 127 to the eUICC 115 to enable the new network service for the network device 102 .
- the operational privileges 117 stored in the authorization token 114 are set by the device management authority 118 to provide the rules to specify what a service provider is allowed to do.
- the operational profile 127 may be a set of data that may be used to enable a service.
- the operation profile 127 may be loaded by the subscription manager 132 , 119 and/or the service provider 134 , 130 into the eUICC 115 to enable the service, as will be described in more detail hereinafter.
- a service provider 134 may be a mobile network operator (MNO), for example, to provide cell-phone service to a network device 102 .
- MNO mobile network operator
- a service provider 130 may be a music company that provides music to a network device 102 .
- Service providers may provide services to a device with a user physically controlling the device (e.g., cell phone, smart phone, laptop computer, tablet, etc.) or a device generally without a user physically controlling the device such as a smart meter.
- service providers 134 , 130 typically cooperate with subscription managers 119 , 132 (which may be managed by the service provider itself or by another company) to manage the subscriptions, profiles, and operations for a network device's use of services. Therefore, service providers 134 , 130 in cooperation subscription managers 119 , 132 may provide a wide variety of services, such as: mobile network connectivity services, music services, texting services, video services, storage services, etc. In particular, for M2M network devices, such services may include global positioning system (GPS), traffic reporting and mapping services for cars, and dynamic meter reading service for smart meters.
- GPS global positioning system
- traffic reporting and mapping services for cars
- dynamic meter reading service for smart meters.
- Embodiments of the invention generally relate to the owner's or device management authority's 118 authorization and security for an eUICC 115 of a network device 102 by utilizing an authorization token 114 to authorize a service provider 134 , 130 to provide a service for the network device 102 and to specify the service providers' operation privileges 117 with the network device 102 .
- the network device 102 may communicate via various links with service providers 134 , 130 and subscription managers 119 , 132 .
- an authorization credential 110 may be selected and programmed into the eUICC 115 and an authorization token 114 may also be stored in the eUICC 115 .
- the operation privileges 117 may be specified in the authorization token 114 and the eUICC 115 may verify the operation privileges and make sure that service provider's rights are not beyond the privileges specified by the device management authority 118 . Therefore, a plurality of different services may be useable by a network device 102 from various service providers and the operation privileges can be controlled by the device management authority 118 . Also, as will be described in more detail hereinafter, the validity 121 of the operation privileges 117 (e.g., how long authorization remains valid (e.g., an expiration time)) may be specified in the authorization token 114 .
- the authorization token 114 may have other attributes that are stored in the authorization token 114 such as: service entity attribute 123 that specifies what service provider is authorized; and a one-time or multiple time attribute 125 that indicates whether the authorization token is a one-time use authorization token or a multiple-time use authorization token.
- service entity attribute 123 that specifies what service provider is authorized
- a one-time or multiple time attribute 125 that indicates whether the authorization token is a one-time use authorization token or a multiple-time use authorization token.
- a usage counter may be utilized to count how many times the token has been used.
- a utility company may be the device management authority 118 and may be the owner of a huge amount of network devices 102 (e.g., smart meters).
- the utility company 118 does not want to manage the operational profile 127 (which contains the network access information to obtain needed cellular services from an MNO service provider 134 ) on the eUICC 115 . Therefore, if utility company 118 wants to subscribe to the service of the MNO service provider's 134 , it will generate an authorization token 114 for the MNO service provider's 134 subscription manager 119 to load MNO's operational profile 127 into the network device's 102 eUICC 115 to give to the MNO 134 .
- subscription manager 119 When, subscription manager 119 transmits its operational profile 127 to the eUICC 115 , it may also get the authorization token 114 from the MNO 134 and transmit it to the eUICC 115 to request the ability to load the operational profile 127 so that the services can be enabled. Once the eUICC 115 verifies that the authorization token 114 has been issued by the utility company/owner 118 to MNO 134 and its subscription manager 119 , then the eUICC 115 will allow the subscription manager 119 to load and install the operational profile 127 of the MNO 134 . Otherwise, the operational profile 127 cannot be loaded and consequently the service cannot be enabled.
- owner/device management authority 118 subscribing to a wide variety of different types of services from a service provider 130 providing a wide variety of services (e.g., music services, texting services, video services, storage services, etc.)
- an authorization credential 110 may be set for the network device 102 and, in particular, may be set inside the eUICC 115 of the network device 102 .
- a manufacturer 307 may set the authorization credential 110 into the network device 102 .
- the authorization credential 110 may be a binary string, a password, a secret key, a public key, or a Root CA certificate that contains a public key, etc.
- the authorization credential 110 may be set by the device manufacture 307 or by the device management authority 118 .
- Network device 102 or the eUICC 115 should protect this authorization credential 110 securely.
- the authorization credential 110 may be stored in the eUICC 115 and the device management authority 118 may be provided with a password to access it. This allows device management authority 118 to change the password and the authorization credential 110 .
- device management authority 118 may store the authorization credential 306 locally on a computing device (e.g., a desktop, lap-top, other mobile device, etc.) as a securely stored authorization credential 306 .
- the manufacturer 307 may provide an application running on the computer or mobile device/cell-phone to protect the authorization credential and to help generate the authorization credential 110 .
- device management authority 118 may authenticate itself to the network device 102 via a password.
- the manufacturer 307 may provide an online service to help the device management authority 118 manage the authentication credential 306 .
- the manufacturer 307 may encrypt an authorization credential 306 and store it in the cloud where it can be accessed by the device management authority 118 . In this way, authentication credential decryption and authorization token generation may be accomplished on the client side.
- the device management authority 118 may login into the eUICC 115 of the network device 102 to generate an authorization token 114 via a secure connection such as using transport layer security/secure sockets layer protocol (TLS/SSL) (as an example). This may be done before deploying the network device 102 . Further, when using the authorization credential 110 on the network device 102 or on a web server, the device management authority 118 may log onto the network device 102 or its corresponding web account. In this way, the authorization token 114 can be emailed to the service provider 130 or uploaded online.
- TLS/SSL transport layer security/secure sockets layer protocol
- the corresponding authorization credential information 306 may be passed to eUICC 115 of the network device 102 (e.g., from a manufacturer 307 or device management authority 118 ) so that the network device 102 can generate an authorization token 114 that may be used to give an operation privilege to a third party entity (e.g. hereinafter referred to as service provider 134 , 130 ).
- a third party entity e.g. hereinafter referred to as service provider 134 , 130
- the service provider 134 , 130 works in cooperation with a subscription manager 119 , 130 .
- device management authority 118 may have the network device 102 generate an authorization token 114 that may be presented to a service provider 134 , 130 . It should be appreciated that if a symmetric key mechanism or password mechanism is utilized that the authorization credential 306 provided to the device management authority 118 may be the same as the authorization credential 110 stored inside the network device 102 . If using a public key mechanism, the authorization credential 306 provided to the device management authority 108 may be the pairing part of the authorization credential 110 stored in the eUICC 115 of the network device 102 .
- the authorization token 114 of the eUICC 115 of the network device 102 may be a digital token that specifies operation privileges 117 (stored in the authorization token 114 ) for a specified or unspecified service provider 134 , 130 and/or subscription manger 119 , 132 . Further, the authorization token 114 received back from service provider 134 , 130 may be verified by the eUICC 115 of the network device 102 to confirm that the operation privileges are authorized by the device management authority 118 .
- the service provider 134 , 130 may not be required to present the token each time when the service provider 134 , 130 tries to access the eUICC.
- the authorization token 114 may be generated by the owner/device management authority 118 logging into the eUICC 115 of the network device 102 locally or by the device management authority 118 logging into the eUICC 115 of the network device 102 remotely from outside (e.g., via remote access).
- the authorization token 114 may be portable and is beneficial in that it may be transmitted to a service provider 134 , 130 to obtain pre-defined operation privileges without exposing the authorization credentials 110 .
- this data may include: token ID, sequence number, signature data (e.g., digital signature with a public key or message authentication checksum (MAC) with a symmetric key), as well as various optional information.
- Optional information may include: eUICC ID, service provider ID, subscription manager ID, device management authority ID or IDs of authorized profiles, and authorized privileges (e.g., particular profiles, particular management operations, etc.).
- the device management authority 118 may use the authorization credential 110 to generate the authorization token on the eUICC.
- network device 102 may provide management commands for the device management authority 118 to generate authorization token, and device management authority 118 may log into the network device 102 to perform these management commands.
- the device management authority 118 may use the credential (e.g., password) that is owned only by the device management authority to log into the network device 102 .
- device management authority 118 may utilize the authorization credential 110 to create an authorization token 114 that may be specified with particular privileges (e.g., operation privileges 117 ) that may be utilized by a third party for management of the network device 102 .
- one of the privileges may be what operations are allowable such as: loading, deleting, enabling, or disabling of a set of data or services of the service provider 134 , 130 .
- Another privilege may be determining which entities (e.g., service providers) can perform operations such as: a list of the IDs of the service providers 134 , 130 and subscription managers 119 , 132 that may be utilized.
- the service entity 123 may be specified in the authorization token 114 .
- privileges that may be specified relates to the validity of the operation privileges.
- the validity 121 may be specified in the authorization token 114 .
- Yet another privilege that may be specified is where operations can be performed, e.g., a list of the eUICC IDs.
- a further example of a privilege that may be specified relates to on which objects the operations can be performed, e.g., which operation profile 127 can be managed by a service provider 134 , 130 or a subscription manager 119 , 132 .
- An additional operational privilege that may be specified in the authorization token 114 is how many times operations can be performed such as one-time or multiple time use 125 , as will be described in more detail hereinafter.
- the authorization token 114 may be provided to the service provider 134 , 130 that will perform the services via a connection.
- service provider 134 , 130 transmits the commands to network device 102 via a connection
- service provider 134 , 130 may provide the authorization token 114 such that the network device 102 can verify that it is authorized by the device management authority 118 using the authorization credential 110 stored within the network device 102 . If verified, the operation privileges specified in the authorization token 114 may be allowed. Otherwise, the services may be rejected.
- device management authority 118 may generate an authorization token 114 that is transmitted via a link to service provider 134 .
- Service provider 134 may transmit the authorization token 114 to subscription manager 119 which may then load operation profile 127 into the eUICC 115 of the network device 102 using the authorization token 114 .
- the eUICC 115 may utilizes its own authorization credential 110 to verify that the subscription manager 119 is authorized to load the operation profile 127 .
- Network device 102 may then utilize services associated with service provider 134 .
- the authorization token 114 may be given to a third party (e.g., service provider 134 ) to use when the device management authority 118 would like to subscribe to a service provided by the service provider 134 .
- a third party e.g., service provider 134
- network device 102 may generate an authorization token 114 for the particular MNO (e.g., MNO 134 ) to allow MNO 134 or the MNO's subscription manager 119 to load operation profile 127 into the eUICC 115 of the network device 102 and consequently manage the loaded operation profile with a credential set by the MNO 134 and the network device can implement various services associated with service provider 134 .
- MNO mobile network operator
- the device management authority 118 may submit the authorization token 114 to the website such that MNO 134 can proceed with the authorization token 114 in a similar manner. Meanwhile other MNOs cannot load operation privileges into the eUICC 115 of the network device 102 without the device management authority's authorization.
- the authorization token 114 may be generated either inside the network device 102 or outside the network device 102 .
- the device management authority 118 may login to the network device 102 using a password and request that the network device 102 generate the authorization token 114 . In this way, the device management authority 118 may only need to know the password and the longer authorization credential 110 may just be stored inside the network device 102 .
- the authorization token 114 may be exported from the network device 102 and be given to another entity, as previously described.
- an external application may be used to generate the authorization token 114 , as well.
- a utility company may have a secure token to generate the authorization token 114 for all of its smart meters (i.e., network devices 102 ) using a private key. As an example, there may be millions of these network device smart meters 102 . If the corresponding public key is set to all of the smart meters (e.g. network devices 102 ), the smart meters can verify this authorization token 114 to determine if an operation is authorized. New programs may be loaded onto all of the smart meter network devices 102 based upon the authorization token remotely.
- an authorization token 114 may be utilized for a one-time use or for multiple-time uses which may be specified by one-time/multiple time attribute 125 .
- a one-time use token may be used only for one time to authorize a new service provider 130 and subscription manager 132 . This may be for an unlimited amount of a time or for a pre-determined period of time. In this way, the authorization token 114 may be set to be valid only for a certain pre-determined time period, to expire at a specific time, or to be useable until canceled.
- a multiple-time use token can be set for use during multiple specified times. As an example, the multiple time token may utilize a usage counter to count how many times the token has been used.
- authorization tokens 114 may utilize incremental sequence numbers. Also, once a newer authorization token is used, the older authorization token may be invalidated. Therefore, it should be appreciated that authorization tokens 114 may be revoked or invalidated. For example, authorization tokens 114 may be revoked based upon a token ID number or based upon a sequence number.
- manufacturer 307 may provide an authorization credential 306 and password to the device management authority 118 of the network device 102 .
- the authorization token 114 is generated with the authorization credential 110 .
- the network device 102 via I/F 103 transmits the authorization token 114 via a link to the service provider 134 along with other eUICC 115 information.
- device management authority 118 is providing the authorization token 114 to the service provider 134 and to the subscription manager 119 to provide permission to manage the eUICC 115 of the network device 102 .
- This provides a secure environment in that only an authorized service provider 134 and subscription manager 119 have permission to manage the network device 102 such that a secure method for authorization is provided.
- new service providers may be added.
- device management authority 118 may generate an authorization token 114 either by logging into the eUICC 115 of the network device 102 or by generating the authorization token 114 externally.
- the network device 102 transmits the authorization token 114 via I/F 103 through a link to a new service provider 130 in conjunction with other eUICC 115 information.
- the authorization token 114 may be generated at any time without the subscription manager 132 being knowable to the device management authority 118 which provides flexibility in managing the authorization.
- a service provider may be changed.
- the device management authority 118 generates an authorization token 114 , either by logging into the eUICC 115 or by generating the authorization token 114 externally.
- the network device 102 transmits the authorization token 114 via I/F 103 through a link to the new service provider 130 along with other eUICC 115 information.
- the authorization token 114 may be generated at any time without knowing the actual subscription manager 132 of the service provider 130 . This provides a very flexible method for managing ownership.
- multiple network devices 102 may be controlled.
- a device management authority 118 may generate an authorization token 114 , either by logging into the eUICC 115 or it may be generated externally. If multiple eUICC's share the same device management authority credentials, device management authority 118 may provide the same authorization token 114 to a single service provider 134 .
- the subscription manager 119 may manage all of the eUICC's 115 of all of the network devices 102 using the same authorization token 114 . This provides an efficient methodology for controlling multiple eUICC's 115 of multiple network devices 102 .
- an authorization token 114 may be utilized to efficiently and securely manage a network device 102 in association with a service provider 134 , 130 .
- the authorization credential 110 in conjunction with a password to generate an authorization token 114 provides a very secure and robust approach.
- the authorization token 114 approach provides security and improves flexibility for the device management authority 118 to manage the operation privileges on the eUICC 115 of the network device 102 for using 3 rd party service providers 134 , 130 , especially in the case when the subscription manager 119 , 132 does not need to be known to the device management authority 118 .
- circuitry of the network device 102 may operate under the control of a program, routine, or the execution of instructions to execute methods or processes in accordance with embodiments of the invention.
- a program may be implemented in firmware or software (e.g. stored in memory and/or other locations) and may be implemented by processors and/or other circuitry.
- processors microprocessor, circuitry, controller, etc.
- processors refer to any type of logic or circuitry capable of executing logic, commands, instructions, software, firmware, functionality, etc.
- mobile or network devices may communicate via one or more wireless communication links through a wireless network that are based on or otherwise support any suitable wireless communication technology.
- the network may comprise a body area network or a personal area network (e.g., an ultra-wideband network).
- the network may comprise a local area network or a wide area network.
- a network device may support or otherwise use one or more of a variety of wireless communication technologies, protocols, or standards such as, for example, CDMA, TDMA, OFDM, OFDMA, WiMAX, and Wi-Fi.
- a network device may support or otherwise use one or more of a variety of corresponding modulation or multiplexing schemes.
- a network device may thus include appropriate components (e.g., air interfaces) to establish and communicate via one or more wireless communication links using the above or other wireless communication technologies.
- a device may comprise a wireless transceiver with associated transmitter and receiver components (e.g., a transmitter and a receiver) that may include various components (e.g., signal generators and signal processors) that facilitate communication over a wireless medium.
- transmitter and receiver components e.g., a transmitter and a receiver
- various components e.g., signal generators and signal processors
- a mobile network device may therefore wirelessly communicate with other mobile devices, cell phones, other wired and wireless computers, Internet web-sites, etc.
- CDMA Code Division Multiple Access
- TDMA Time division multiple access
- FDMA Frequency Division Multiple Access
- OFDMA Orthogonal Frequency-Division Multiple Access
- SC-FDMA Single Carrier FDMA
- a CDMA system can implement a radio technology such as Universal Terrestrial Radio Access (UTRA), CDMA2000, etc.
- UTRA includes Wideband-CDMA (W-CDMA) and other variants of CDMA.
- CDMA2000 covers Interim Standard (IS)-2000, IS-95 and IS-856 standards.
- a TDMA system can implement a radio technology such as Global System for Mobile Communications (GSM).
- GSM Global System for Mobile Communications
- An OFDMA system can implement a radio technology such as Evolved Universal Terrestrial Radio Access; (Evolved UTRA or E-UTRA), Ultra Mobile Broadband (UMB), Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDM®, etc.
- Universal Terrestrial Radio Access (UTRA) and E-UTRA are part of Universal Mobile Telecommunication System (UMTS).
- 3GPP Long Term Evolution (LTE) is an upcoming release of UMTS that uses E-UTRA, which employs OFDMA on the downlink and SC-FDMA on the uplink.
- UTRA, E-UTRA, UMTS, LTE and GSM are described in documents from an organization named “3rd Generation Partnership Project” (3GPP).
- CDMA2000 and UMB are described in documents from an organization named “3rd Generation Partnership Project 2” (3GPP2).
- teachings herein may be incorporated into (e.g., implemented within or performed by) a variety of apparatuses (e.g., devices).
- a phone e.g., a cellular phone
- PDA personal data assistant
- a tablet e.g., a mobile computer
- a laptop computer e.g., a tablet
- an entertainment device e.g., a music or video device
- a headset e.g., headphones, an earpiece, etc.
- a user I/O device e.g., a computer, a server, a point-of-sale device, an entertainment device, a set-top box, or any other suitable device.
- These devices may have different power and data requirements
- a network device may comprise an access device (e.g., a Wi-Fi access point) for a communication system.
- an access device may provide, for example, connectivity to another network (e.g., a wide area network such as the Internet or a cellular network) via a wired or wireless communication link.
- the access device may enable another device (e.g., a Wi-Fi station) to access the other network or some other functionality.
- another device e.g., a Wi-Fi station
- one or both of the devices may be portable or, in some cases, relatively non-portable.
- DSP digital signal processor
- ASIC application specific integrated circuit
- FPGA field programmable gate array
- a general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine.
- a processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
- a software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
- An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
- the storage medium may be integral to the processor.
- the processor and the storage medium may reside in an ASIC.
- the ASIC may reside in a user terminal.
- the processor and the storage medium may reside as discrete components in a user terminal.
- the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
- Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
- a storage media may be any available media that can be accessed by a computer.
- such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.
- any connection is properly termed a computer-readable medium.
- the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave
- the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium.
- Disk and disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.
Abstract
Description
- This application claims the benefit of priority of prior provisional patent application No. 61/734,315, entitled MANAGEMENT OF NETWORK DEVICES UTILIZING AN AUTHORIZATION TOKEN, filed on Dec. 6, 2012, which application is incorporated herein by reference.
- 1. Field
- The present invention relates generally to the management of network devices utilizing an authorization token.
- 2. Relevant Background
- Currently, universal integrated circuit cards (UICCs) are owned, managed, and distributed by a particular mobile network operator (MNO) and are removable from the network device (e.g., a cell phone). For example, if a network device owner wants to change a subscription service to a different MNO, the network device owner needs to remove the UICC and put in a new UICC from the new service provider (e.g., another MNO). This is a costly and time consuming process. Further, in many machine-to-machine (M2M) use cases, such as, smart meters or wireless modems in a car, changing the UICC likewise requires a great deal of work and is very costly.
- Embedded universal integrated circuit cards (eUICCs) are currently being considered for use in network devices (e.g., cell phones, tablets, M2M devices, etc.) which may reduce costs and eliminates the need to remove and replace UICCs from network devices. However, embedded UICCs (eUICCs) for use in network devices present many challenges related to ownership management, subscription management, as well as, security issues. As a particular example, techniques to prevent unauthorized entities from loading, enabling, disabling, and/or deleting services and profiles need to be addressed as well as techniques to allow authorized entities to enable services and manage profiles. This is pertinent both for user-controlled network devices (e.g., cell phones) as well as M2M devices that a user typically does not physically interact with.
- Aspects of the invention may relate to an apparatus, system, and method for the management of network devices utilizing an authorization token. In one embodiment, an authorization token received from a service provider may be verified using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device. Further, operation privileges may be enforced that are contained in the authorization token.
-
FIG. 1 is block diagram of a system in which embodiments of the invention related to the management of network devices utilizing an authorization token may be practiced. -
FIG. 2 is a flow diagram illustrating a process implemented by a network device to utilize an authorization token. -
FIG. 3 is block diagram particularly showing a network device utilizing an authorization token. - The word “example” or “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any aspect or embodiment described herein as “exemplary” or as an “example” in not necessarily to be construed as preferred or advantageous over other aspects or embodiments.
- With reference to
FIG. 1 ,FIG. 1 is a block diagram of asystem 100 in which embodiments of the invention may be practiced. As will be described, embodiments of the invention relate to anetwork device 102 that includes aninterface 103, aprocessor 104, and amemory 105 that may store an authorization credential(s) 110 and an authorization token(s) 114. In one embodiment, at least theprocessor 104 and thememory 105 may be configured in an embedded universal integrated circuit card (eUICC) 115. However, the eUICC 115 may include some or all of the components regularly utilized by an UICC. - As will be described in more detail later,
processor 104 may execute functions including: generating anauthorization token 114 using anauthorization credential 110; commanding the transmission of theauthorization token 114 to adevice management authority 118 or to aservice provider 134,130 (if authorized by the device management authority 118) via the network interface (I/F) 103 through a link; verifying theauthorization token 114 received back from theservice provider authorization credential 110 to determine if theservice provider network device 102; and enforcing operation privileges contained in theauthorization token 114. Although one authorization credential and one authorization token are referred to, it should be appreciated that multiple authorization credentials and authorization tokens may be utilized. Also, thedevice management authority 118 generally refers to the owner of thenetwork device 102 or an entity that has the authority to authorize another entity to manage the data or service on the eUICC 115 or thenetwork device 102. - Further, it should be appreciated that
network device 102 may be any type of suitable network device (e.g. laptop computer, mobile device, non-mobile device, smart phone, cell phone, tablet, personal digital assistant (PDA), machine-to-machine (M2M) device, personal computer, server computer, etc.) having aprocessor 104 and amemory 105 to implement the previously described functionality and the hereinafter to be described functionality. - Also,
network device 102 may include auser interface 120 which may be any suitable type of input mechanism, e.g., keyboard, keypad, touch-screen, voice recognition, microphone, etc. Further, I/F 103 may be a suitable wireless interface and may include suitable transceiver components (e.g. a wireless transmitter and receiver) to send and receive data over a wireless link or may be a suitable wired interface for connection by a suitable cable, wire, etc. (e.g., a wired link). Therefore, the term links to be hereinafter described may be wireless or wired links. Additionally,network device 102 may include a display device 112, such as, a commonly used display device that is implemented with a network device. - In one embodiment, in order to address issues related to owner authorization and security for embedded universal integrated circuit cards (eUICCs), an
authorization token 114 of anetwork device 102 may be used to authorize an entity (e.g., aservice provider 134,130) to provide a service for thenetwork device 102 and to specify its operation privileges with the network device, as will be described in detail hereinafter. - As an example, as shown in
FIG. 1 ,network device 102 may communicate via various links withservice providers authorization credential 110 may be selected and programmed into thememory 105 of the eUICC 115 and anauthorization token 114 may also be stored inmemory 105. It should be appreciated thatauthorization credentials 110 may be at least one of a binary string, a password, a secret key, a public key, or a combination thereof. - Turning briefly to
FIG. 2 ,FIG. 2 is a flow diagram illustrating aprocess 200 to generate and verify anauthorization token 114. In particular, atblock 202,processor 104 may generate anauthorization token 114 that may be based upon anauthorization credential 110. Next, atblock 204,processor 104 may command a transmission of theauthorization token 114 to adevice management authority 118 or to aservice provider device management authority 118. Further, atblock 206, based upon anauthorization token 114 received from aservice provider processor 104 may verify theauthorization token 114 from the service provider using theauthorization credential 110 to determine if the service provider is authorized to perform requested operations with thenetwork device 102. Additionally, atblock 208,processor 104 may enforce operation privileges contained in the authorization token. - Additionally,
processor 104 may further execute functions to specify operation privileges associated with services that are allowable from theservice provider authorization token 114. For example, such operation privileges may include loading, deleting, enabling, or disabling a set of data or services of theservice provider - With additional reference to
FIG. 3 , anauthorization credential 110 is typically created and stored in the eUICC 115 such that only thedevice management authority 118 may access it. Alternatively, a copy of theauthorization credential 306 may be given to thedevice management authority 118 such that thedevice management authority 118 may use theauthorization credential 306 without access to thenetwork device 102. As a particular example, themanufacturer 307 of the eUICC 115 may create theauthorization credential 306 and store it in the eUICC 115 or thenetwork device 102 as shown asauthorization credential 110. However, theauthorization credential 306 may also be provided to thedevice management authority 118 which may hold a copy. Again, thedevice management authority 118 is considered to be the “owner” of the eUICC 115 and/or thenetwork device 102. - Utilizing this methodology, if the
device management authority 118 wants to authorize an entity (e.g. aservice provider 134,130), which is typically in association with asubscription manager network device 102 and to manage operations on the eUICC 115, thedevice management authority 118 may generate anauthorization token 114 for use by theservice provider device management authority 118 may authorize thenetwork device 102 to generate theauthorization token 114 and transmit it to theservice provider service provider service provider authorization token 114 to its associatedsubscription manager subscription manager network device 102 or the eUICC 115 to manage the service on the eUICC 115 or thenetwork device 102, it will present theauthorization token 114 to the eUICC 115 to prove that it is authorized by thedevice management authority 118. The eUICC 115 will use theauthorization credential 110 to verify theauthorization token 114 and to confirm that thesubscription manager device management authority 118. Inside theauthorization token 114, thedevice management authority 118 may specify theoperation privileges 117 for theservice provider - In particular, as an example, the
authorization token 114 may be created with the device management authority'sauthorization credential 306 such that only thedevice management authority 118 can create thisauthorization token 114. When thedevice management authority 118 needs to authorize aservice provider device management authority 118 wants to subscribes to a new service provided by theservice provider 134,130),network device 102 via I/F 103 transmits theauthorization token 114 to theservice provider device management authority 118 or thenetwork device 102 may transmit theauthorization token 114. Conversely, when the authorizedservice provider eUICC 115 of thenetwork device 102, theservice provider authorization token 114 to theeUICC 115 of thenetwork device 102 and the eUICC may verify the authorization token using the device management authority'sauthorization token 114 stored in the eUICC. In particular, thenetwork device 102 can verify the authorization token 114 from theservice provider authorization credential 110 to determine if the service provider is authorized to perform requested operations with the network device. - In other embodiments, if the
network device 102 is not accessible for thedevice management authority 118 to generate theauthorization token 114, theauthorization token 114 may be generated outside of thenetwork device 102, such as by thedevice management authority 118 using theauthorization credential 306. For example, thedevice management authority 118 may include a copy of the authorization credential 306 (e.g., stored in a secure memory) and may input theauthorization credential 306 into a computer program to generate theauthorization token 114. And then thedevice management authority 118 may transmit theauthorization token 114 to theservice provider authorization token 114 is not transmitted to the service provider by thenetwork device 102. Later theservice provider authorization token 114 to theeUICC 115 directly or via thesubscription manager eUICC 115 that thedevice management authority 118 has authorized theservice provider subscription manager eUICC 115. - Therefore, the device management authority 118 (i.e., the owner of the network device) may generate the
authorization token 114, set theoperation privileges 117 in theauthorization token 114, and may transmit theauthorization token 114 to theservice provider authorization token 114 may also be directly transmitted by thenetwork device 102 to theservice provider authorization token 114 generation may occur at thenetwork device 102 itself, butauthorization token 114 generation may also occur outside thenetwork device 102. For example, themanagement authority 118 may make a copy of theauthorization credential 306 and store it securely. In this way,many network devices 102 may be managed by thedevice management authority 118 at the same time without accessing eachnetwork device 102. Furthermore, if thedevice management authority 118 sets thesame authorization credential 110 inmany network devices 102, oneauthorization token 114 may be used for all thenetwork devices 102 that have thesame authorization credential 110. Further, by having theauthorization credential 306 stored outside of thenetwork device 102, thedevice management authority 118 can generate theauthorization token 114 without having to access/connect to the network device. This may be useful for some use cases in which thenetwork device 102 is deployed remotely and thedevice management authority 118 has lost access/communication with thenetwork device 102. In order to activate a new service, thedevice management authority 118 can use the storedauthorization credential 306 to generate anauthorization token 114 to give to a new service provider (e.g. MNO 134) to load anoperational profile 127 to theeUICC 115 to enable the new network service for thenetwork device 102. It should be appreciated that theoperational privileges 117 stored in theauthorization token 114 are set by thedevice management authority 118 to provide the rules to specify what a service provider is allowed to do. Theoperational profile 127 may be a set of data that may be used to enable a service. Theoperation profile 127 may be loaded by thesubscription manager service provider eUICC 115 to enable the service, as will be described in more detail hereinafter. - It should be appreciated that various services may be provided by
service providers subscription manager service provider 134 may be a mobile network operator (MNO), for example, to provide cell-phone service to anetwork device 102. As another example, aservice provider 130 may be a music company that provides music to anetwork device 102. Service providers may provide services to a device with a user physically controlling the device (e.g., cell phone, smart phone, laptop computer, tablet, etc.) or a device generally without a user physically controlling the device such as a smart meter. Also,service providers subscription managers 119,132 (which may be managed by the service provider itself or by another company) to manage the subscriptions, profiles, and operations for a network device's use of services. Therefore,service providers cooperation subscription managers - Embodiments of the invention generally relate to the owner's or device management authority's 118 authorization and security for an
eUICC 115 of anetwork device 102 by utilizing anauthorization token 114 to authorize aservice provider network device 102 and to specify the service providers'operation privileges 117 with thenetwork device 102. Thenetwork device 102 may communicate via various links withservice providers subscription managers authorization credential 110 may be selected and programmed into theeUICC 115 and anauthorization token 114 may also be stored in theeUICC 115. Moreover, theoperation privileges 117 may be specified in theauthorization token 114 and theeUICC 115 may verify the operation privileges and make sure that service provider's rights are not beyond the privileges specified by thedevice management authority 118. Therefore, a plurality of different services may be useable by anetwork device 102 from various service providers and the operation privileges can be controlled by thedevice management authority 118. Also, as will be described in more detail hereinafter, thevalidity 121 of the operation privileges 117 (e.g., how long authorization remains valid (e.g., an expiration time)) may be specified in theauthorization token 114. Further, as will be described in more detail hereinafter, theauthorization token 114 may have other attributes that are stored in theauthorization token 114 such as:service entity attribute 123 that specifies what service provider is authorized; and a one-time ormultiple time attribute 125 that indicates whether the authorization token is a one-time use authorization token or a multiple-time use authorization token. As will be described in more detail hereinafter, with the multiple time token, a usage counter may be utilized to count how many times the token has been used. - A particular example will now be provided. For example, a utility company may be the
device management authority 118 and may be the owner of a huge amount of network devices 102 (e.g., smart meters). Theutility company 118 does not want to manage the operational profile 127 (which contains the network access information to obtain needed cellular services from an MNO service provider 134) on theeUICC 115. Therefore, ifutility company 118 wants to subscribe to the service of the MNO service provider's 134, it will generate anauthorization token 114 for the MNO service provider's 134subscription manager 119 to load MNO'soperational profile 127 into the network device's 102eUICC 115 to give to theMNO 134. When,subscription manager 119 transmits itsoperational profile 127 to theeUICC 115, it may also get the authorization token 114 from theMNO 134 and transmit it to theeUICC 115 to request the ability to load theoperational profile 127 so that the services can be enabled. Once theeUICC 115 verifies that theauthorization token 114 has been issued by the utility company/owner 118 toMNO 134 and itssubscription manager 119, then theeUICC 115 will allow thesubscription manager 119 to load and install theoperational profile 127 of theMNO 134. Otherwise, theoperational profile 127 cannot be loaded and consequently the service cannot be enabled. - It should be appreciated that these aspects are beneficial in that: 1) in the instance that a large quantity of
M2M devices 102 are being utilized, in order to change a subscription service from aservice provider 134, only oneauthorization token 114 may be given to thenew service provider 134; and 2) thedevice management authority 118 does not need to change eUICC configuration/settings before a new authorizedservice provider 134 can access theeUICC 115. Further, although the previous example refers to a utility company as the owner/device management authority 118 subscribing to anMNO service provider 134 for an M2M network device, the same methodology would apply to an individual user/device management authority 118 subscribing to an MNO for a cell-phone network device. Moreover, the same methodology would apply to owner/device management authority 118 subscribing to a wide variety of different types of services from aservice provider 130 providing a wide variety of services (e.g., music services, texting services, video services, storage services, etc.) - As previously described, embodiments of the invention relate to managing ownership and operation privileges for a third party (such as subscription manager 119) to manage the services on a
remote network device 102. In particular, anauthorization credential 110 may be set for thenetwork device 102 and, in particular, may be set inside theeUICC 115 of thenetwork device 102. As an example, amanufacturer 307 may set theauthorization credential 110 into thenetwork device 102. Theauthorization credential 110 may be a binary string, a password, a secret key, a public key, or a Root CA certificate that contains a public key, etc. In particular, theauthorization credential 110 may be set by thedevice manufacture 307 or by thedevice management authority 118.Network device 102 or theeUICC 115 should protect thisauthorization credential 110 securely. - Further, there are various options related to the management of authorization credentials. For example, the
authorization credential 110 may be stored in theeUICC 115 and thedevice management authority 118 may be provided with a password to access it. This allowsdevice management authority 118 to change the password and theauthorization credential 110. Additionally,device management authority 118 may store theauthorization credential 306 locally on a computing device (e.g., a desktop, lap-top, other mobile device, etc.) as a securely storedauthorization credential 306. As another example, themanufacturer 307 may provide an application running on the computer or mobile device/cell-phone to protect the authorization credential and to help generate theauthorization credential 110. Again,device management authority 118 may authenticate itself to thenetwork device 102 via a password. - As yet another example, the
manufacturer 307 may provide an online service to help thedevice management authority 118 manage theauthentication credential 306. For example, themanufacturer 307 may encrypt anauthorization credential 306 and store it in the cloud where it can be accessed by thedevice management authority 118. In this way, authentication credential decryption and authorization token generation may be accomplished on the client side. - Moreover, when the
authorization credential 110 is in theeUICC 115, thedevice management authority 118 may login into theeUICC 115 of thenetwork device 102 to generate anauthorization token 114 via a secure connection such as using transport layer security/secure sockets layer protocol (TLS/SSL) (as an example). This may be done before deploying thenetwork device 102. Further, when using theauthorization credential 110 on thenetwork device 102 or on a web server, thedevice management authority 118 may log onto thenetwork device 102 or its corresponding web account. In this way, theauthorization token 114 can be emailed to theservice provider 130 or uploaded online. - As another example, the corresponding
authorization credential information 306 may be passed toeUICC 115 of the network device 102 (e.g., from amanufacturer 307 or device management authority 118) so that thenetwork device 102 can generate anauthorization token 114 that may be used to give an operation privilege to a third party entity (e.g. hereinafter referred to asservice provider 134,130). As previously described, theservice provider subscription manager - Thus,
device management authority 118 may have thenetwork device 102 generate anauthorization token 114 that may be presented to aservice provider authorization credential 306 provided to thedevice management authority 118 may be the same as theauthorization credential 110 stored inside thenetwork device 102. If using a public key mechanism, theauthorization credential 306 provided to the device management authority 108 may be the pairing part of theauthorization credential 110 stored in theeUICC 115 of thenetwork device 102. - As to the
authorization token 114, in one embodiment, theauthorization token 114 of theeUICC 115 of thenetwork device 102 may be a digital token that specifies operation privileges 117 (stored in the authorization token 114) for a specified orunspecified service provider subscription manger authorization token 114 received back fromservice provider eUICC 115 of thenetwork device 102 to confirm that the operation privileges are authorized by thedevice management authority 118. Optionally, if theauthorization token 114 is stored in theeUICC 115 already, theservice provider service provider authorization token 114 may be generated by the owner/device management authority 118 logging into theeUICC 115 of thenetwork device 102 locally or by thedevice management authority 118 logging into theeUICC 115 of thenetwork device 102 remotely from outside (e.g., via remote access). In particular, theauthorization token 114 may be portable and is beneficial in that it may be transmitted to aservice provider authorization credentials 110. - Moreover, a variety of different types of information may be included in the data of the
authorization token 114. For example, this data may include: token ID, sequence number, signature data (e.g., digital signature with a public key or message authentication checksum (MAC) with a symmetric key), as well as various optional information. Optional information may include: eUICC ID, service provider ID, subscription manager ID, device management authority ID or IDs of authorized profiles, and authorized privileges (e.g., particular profiles, particular management operations, etc.). - There are many methods for the
device management authority 118 to use theauthorization credential 110 to generate the authorization token on the eUICC. For example,network device 102 may provide management commands for thedevice management authority 118 to generate authorization token, anddevice management authority 118 may log into thenetwork device 102 to perform these management commands. Thedevice management authority 118 may use the credential (e.g., password) that is owned only by the device management authority to log into thenetwork device 102. - As an example,
device management authority 118 may utilize theauthorization credential 110 to create anauthorization token 114 that may be specified with particular privileges (e.g., operation privileges 117) that may be utilized by a third party for management of thenetwork device 102. For example, one of the privileges may be what operations are allowable such as: loading, deleting, enabling, or disabling of a set of data or services of theservice provider service providers subscription managers service entity 123 may be specified in theauthorization token 114. Another example of privileges that may be specified relates to the validity of the operation privileges. As an example, thevalidity 121 may be specified in theauthorization token 114. For example, for how long authorization remains (e.g., an expiration time) may be specified as the validity component. Yet another privilege that may be specified is where operations can be performed, e.g., a list of the eUICC IDs. A further example of a privilege that may be specified relates to on which objects the operations can be performed, e.g., whichoperation profile 127 can be managed by aservice provider subscription manager authorization token 114 is how many times operations can be performed such as one-time ormultiple time use 125, as will be described in more detail hereinafter. - After the
authorization token 114 has been defined, theauthorization token 114 may be provided to theservice provider service provider network device 102 via a connection,service provider authorization token 114 such that thenetwork device 102 can verify that it is authorized by thedevice management authority 118 using theauthorization credential 110 stored within thenetwork device 102. If verified, the operation privileges specified in theauthorization token 114 may be allowed. Otherwise, the services may be rejected. - As a particular example,
device management authority 118 may generate anauthorization token 114 that is transmitted via a link toservice provider 134.Service provider 134 may transmit theauthorization token 114 tosubscription manager 119 which may then loadoperation profile 127 into theeUICC 115 of thenetwork device 102 using theauthorization token 114. TheeUICC 115 may utilizes itsown authorization credential 110 to verify that thesubscription manager 119 is authorized to load theoperation profile 127.Network device 102 may then utilize services associated withservice provider 134. - Thus, the
authorization token 114 may be given to a third party (e.g., service provider 134) to use when thedevice management authority 118 would like to subscribe to a service provided by theservice provider 134. For example, ifdevice management authority 118 wants to subscribe to a mobile network operator (MNO) service,network device 102 may generate anauthorization token 114 for the particular MNO (e.g., MNO 134) to allowMNO 134 or the MNO'ssubscription manager 119 to loadoperation profile 127 into theeUICC 115 of thenetwork device 102 and consequently manage the loaded operation profile with a credential set by theMNO 134 and the network device can implement various services associated withservice provider 134. Further, as another example, when thedevice management authority 118 orders the service from MNO's 134 website, thedevice management authority 118 may submit theauthorization token 114 to the website such thatMNO 134 can proceed with theauthorization token 114 in a similar manner. Meanwhile other MNOs cannot load operation privileges into theeUICC 115 of thenetwork device 102 without the device management authority's authorization. - It should be appreciated that the
authorization token 114 may be generated either inside thenetwork device 102 or outside thenetwork device 102. For example, thedevice management authority 118 may login to thenetwork device 102 using a password and request that thenetwork device 102 generate theauthorization token 114. In this way, thedevice management authority 118 may only need to know the password and thelonger authorization credential 110 may just be stored inside thenetwork device 102. However, theauthorization token 114 may be exported from thenetwork device 102 and be given to another entity, as previously described. - As an example, an external application may be used to generate the
authorization token 114, as well. For example, a utility company may have a secure token to generate theauthorization token 114 for all of its smart meters (i.e., network devices 102) using a private key. As an example, there may be millions of these network devicesmart meters 102. If the corresponding public key is set to all of the smart meters (e.g. network devices 102), the smart meters can verify thisauthorization token 114 to determine if an operation is authorized. New programs may be loaded onto all of the smartmeter network devices 102 based upon the authorization token remotely. - Further, it should be appreciated that an
authorization token 114 may be utilized for a one-time use or for multiple-time uses which may be specified by one-time/multiple time attribute 125. For example, a one-time use token may be used only for one time to authorize anew service provider 130 andsubscription manager 132. This may be for an unlimited amount of a time or for a pre-determined period of time. In this way, theauthorization token 114 may be set to be valid only for a certain pre-determined time period, to expire at a specific time, or to be useable until canceled. Further, a multiple-time use token can be set for use during multiple specified times. As an example, the multiple time token may utilize a usage counter to count how many times the token has been used. Thus, theauthorization tokens 114 may utilize incremental sequence numbers. Also, once a newer authorization token is used, the older authorization token may be invalidated. Therefore, it should be appreciated thatauthorization tokens 114 may be revoked or invalidated. For example,authorization tokens 114 may be revoked based upon a token ID number or based upon a sequence number. - Examples of Usage Cases Will Now be Described.
- As an example of an
initial service provider 134 set up,manufacturer 307 may provide anauthorization credential 306 and password to thedevice management authority 118 of thenetwork device 102. Based upon thedevice management authority 118 logging into thenetwork device 102 with the password and specifying the privileges in the token, theauthorization token 114 is generated with theauthorization credential 110. Thenetwork device 102 via I/F 103 transmits theauthorization token 114 via a link to theservice provider 134 along withother eUICC 115 information. In this way,device management authority 118 is providing theauthorization token 114 to theservice provider 134 and to thesubscription manager 119 to provide permission to manage theeUICC 115 of thenetwork device 102. This provides a secure environment in that only an authorizedservice provider 134 andsubscription manager 119 have permission to manage thenetwork device 102 such that a secure method for authorization is provided. - As another example, new service providers may be added. In this example,
device management authority 118 may generate anauthorization token 114 either by logging into theeUICC 115 of thenetwork device 102 or by generating theauthorization token 114 externally. Thenetwork device 102 transmits theauthorization token 114 via I/F 103 through a link to anew service provider 130 in conjunction withother eUICC 115 information. In this way, theauthorization token 114 may be generated at any time without thesubscription manager 132 being knowable to thedevice management authority 118 which provides flexibility in managing the authorization. - As a further example, a service provider may be changed. In this example, the
device management authority 118 generates anauthorization token 114, either by logging into theeUICC 115 or by generating theauthorization token 114 externally. Thenetwork device 102 transmits theauthorization token 114 via I/F 103 through a link to thenew service provider 130 along withother eUICC 115 information. In this way, theauthorization token 114 may be generated at any time without knowing theactual subscription manager 132 of theservice provider 130. This provides a very flexible method for managing ownership. - As yet another example,
multiple network devices 102 may be controlled. For example, adevice management authority 118 may generate anauthorization token 114, either by logging into theeUICC 115 or it may be generated externally. If multiple eUICC's share the same device management authority credentials,device management authority 118 may provide thesame authorization token 114 to asingle service provider 134. Thesubscription manager 119 may manage all of the eUICC's 115 of all of thenetwork devices 102 using thesame authorization token 114. This provides an efficient methodology for controlling multiple eUICC's 115 ofmultiple network devices 102. - It should be appreciated that there are many previously-described examples of how an
authorization token 114 may be utilized to efficiently and securely manage anetwork device 102 in association with aservice provider authorization credential 110 in conjunction with a password to generate anauthorization token 114 provides a very secure and robust approach. In particular, theauthorization token 114 approach provides security and improves flexibility for thedevice management authority 118 to manage the operation privileges on theeUICC 115 of thenetwork device 102 for using 3rdparty service providers subscription manager device management authority 118. - It should be appreciated that aspects of the invention previously described may be implemented in conjunction with the execution of instructions by a processor. Particularly, circuitry of the
network device 102, including but not limited to processors, may operate under the control of a program, routine, or the execution of instructions to execute methods or processes in accordance with embodiments of the invention. For example, such a program may be implemented in firmware or software (e.g. stored in memory and/or other locations) and may be implemented by processors and/or other circuitry. Further, it should be appreciated that the terms processor, microprocessor, circuitry, controller, etc., refer to any type of logic or circuitry capable of executing logic, commands, instructions, software, firmware, functionality, etc. - It should be appreciated mobile or network devices may communicate via one or more wireless communication links through a wireless network that are based on or otherwise support any suitable wireless communication technology. In some aspects the network may comprise a body area network or a personal area network (e.g., an ultra-wideband network). In some aspects the network may comprise a local area network or a wide area network. A network device may support or otherwise use one or more of a variety of wireless communication technologies, protocols, or standards such as, for example, CDMA, TDMA, OFDM, OFDMA, WiMAX, and Wi-Fi. Similarly, a network device may support or otherwise use one or more of a variety of corresponding modulation or multiplexing schemes. A network device may thus include appropriate components (e.g., air interfaces) to establish and communicate via one or more wireless communication links using the above or other wireless communication technologies. For example, a device may comprise a wireless transceiver with associated transmitter and receiver components (e.g., a transmitter and a receiver) that may include various components (e.g., signal generators and signal processors) that facilitate communication over a wireless medium. As is well known, a mobile network device may therefore wirelessly communicate with other mobile devices, cell phones, other wired and wireless computers, Internet web-sites, etc.
- The techniques described herein can be used for various wireless communication systems such as Code Division Multiple Access (CDMA), Time division multiple access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency-Division Multiple Access (OFDMA), Single Carrier FDMA (SC-FDMA) and other systems. The terms “system” and “network” are often used interchangeably. A CDMA system can implement a radio technology such as Universal Terrestrial Radio Access (UTRA), CDMA2000, etc. UTRA includes Wideband-CDMA (W-CDMA) and other variants of CDMA. CDMA2000 covers Interim Standard (IS)-2000, IS-95 and IS-856 standards. A TDMA system can implement a radio technology such as Global System for Mobile Communications (GSM). An OFDMA system can implement a radio technology such as Evolved Universal Terrestrial Radio Access; (Evolved UTRA or E-UTRA), Ultra Mobile Broadband (UMB), Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDM®, etc. Universal Terrestrial Radio Access (UTRA) and E-UTRA are part of Universal Mobile Telecommunication System (UMTS). 3GPP Long Term Evolution (LTE) is an upcoming release of UMTS that uses E-UTRA, which employs OFDMA on the downlink and SC-FDMA on the uplink. UTRA, E-UTRA, UMTS, LTE and GSM are described in documents from an organization named “3rd Generation Partnership Project” (3GPP). CDMA2000 and UMB are described in documents from an organization named “3rd Generation Partnership Project 2” (3GPP2).
- The teachings herein may be incorporated into (e.g., implemented within or performed by) a variety of apparatuses (e.g., devices). For example, one or more aspects taught herein may be incorporated into a phone (e.g., a cellular phone), a personal data assistant (“PDA”), a tablet, a mobile computer, a laptop computer, a tablet, an entertainment device (e.g., a music or video device), a headset (e.g., headphones, an earpiece, etc.), a user I/O device, a computer, a server, a point-of-sale device, an entertainment device, a set-top box, or any other suitable device. These devices may have different power and data requirements
- In some aspects, a network device may comprise an access device (e.g., a Wi-Fi access point) for a communication system. Such an access device may provide, for example, connectivity to another network (e.g., a wide area network such as the Internet or a cellular network) via a wired or wireless communication link. Accordingly, the access device may enable another device (e.g., a Wi-Fi station) to access the other network or some other functionality. In addition, it should be appreciated that one or both of the devices may be portable or, in some cases, relatively non-portable.
- Those of skill in the art would understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.
- Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
- The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
- The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal.
- In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.
- The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (49)
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/787,522 US9264413B2 (en) | 2012-12-06 | 2013-03-06 | Management of network devices utilizing an authorization token |
CN201380062939.4A CN104823408A (en) | 2012-12-06 | 2013-12-06 | Management of network devices utilizing authorization token |
PCT/US2013/073648 WO2014089474A1 (en) | 2012-12-06 | 2013-12-06 | Management of network devices utilizing an authorization token |
KR1020157017660A KR20150093737A (en) | 2012-12-06 | 2013-12-06 | Management of network devices utilizing an authorization token |
JP2015545883A JP6335917B2 (en) | 2012-12-06 | 2013-12-06 | Managing network devices that use authorization tokens |
EP13812357.5A EP2929655A1 (en) | 2012-12-06 | 2013-12-06 | Management of network devices utilizing an authorization token |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201261734315P | 2012-12-06 | 2012-12-06 | |
US13/787,522 US9264413B2 (en) | 2012-12-06 | 2013-03-06 | Management of network devices utilizing an authorization token |
Publications (2)
Publication Number | Publication Date |
---|---|
US20140165155A1 true US20140165155A1 (en) | 2014-06-12 |
US9264413B2 US9264413B2 (en) | 2016-02-16 |
Family
ID=50882543
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/787,522 Expired - Fee Related US9264413B2 (en) | 2012-12-06 | 2013-03-06 | Management of network devices utilizing an authorization token |
Country Status (6)
Country | Link |
---|---|
US (1) | US9264413B2 (en) |
EP (1) | EP2929655A1 (en) |
JP (1) | JP6335917B2 (en) |
KR (1) | KR20150093737A (en) |
CN (1) | CN104823408A (en) |
WO (1) | WO2014089474A1 (en) |
Cited By (27)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20140372528A1 (en) * | 2013-06-13 | 2014-12-18 | Fujitsu Limited | Information processing system, information processing apparatus, and recording medium |
US20150074764A1 (en) * | 2013-09-12 | 2015-03-12 | The Boeing Company | Method of authorizing an operation to be performed on a targeted computing device |
US20150163056A1 (en) * | 2013-11-19 | 2015-06-11 | John A. Nix | Embedded Universal Integrated Circuit Card Supporting Two-Factor Authentication |
US20150350219A1 (en) * | 2013-11-19 | 2015-12-03 | Telefonaktiebolaget L M Ericsson (Publ) | Profile change management |
US9225813B2 (en) | 2011-10-13 | 2015-12-29 | The Boeing Company | Portable communication devices with accessory functions and related methods |
WO2015199319A1 (en) * | 2014-06-23 | 2015-12-30 | Samsung Electronics Co., Ltd. | Method and apparatus for optimizing internet communications |
CN105282729A (en) * | 2014-06-23 | 2016-01-27 | 三星电子株式会社 | Method and apparatus for optimizing internet communications |
US9276740B2 (en) | 2013-09-10 | 2016-03-01 | M2M And Iot Technologies, Llc | Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI) |
US20160098616A1 (en) * | 2014-10-02 | 2016-04-07 | Facebook, Inc. | Techniques for managing discussion sharing on a mobile platform |
US9497221B2 (en) | 2013-09-12 | 2016-11-15 | The Boeing Company | Mobile communication device and method of operating thereof |
US20160352698A1 (en) * | 2013-12-05 | 2016-12-01 | Huawei Device Co., Ltd. | Security control method for euicc and euicc |
WO2017196360A1 (en) * | 2016-05-13 | 2017-11-16 | Nokia Solutions And Networks Oy | Optimized small data transmission over uplink |
US10064240B2 (en) | 2013-09-12 | 2018-08-28 | The Boeing Company | Mobile communication device and method of operating thereof |
US20180278607A1 (en) * | 2017-03-22 | 2018-09-27 | Amazon Technologies, Inc. | Device Credentials Management |
WO2019126185A1 (en) * | 2017-12-18 | 2019-06-27 | Convida Wireless, Llc | Methods to enable context aware authorization for data or services in the iot/m2m service layer |
US10476671B2 (en) | 2014-07-17 | 2019-11-12 | Samsung Electronics Co., Ltd. | Method and device for installing profile of eUICC |
US10484376B1 (en) | 2015-01-26 | 2019-11-19 | Winklevoss Ip, Llc | Authenticating a user device associated with a user to communicate via a wireless network in a secure web-based environment |
US10498530B2 (en) | 2013-09-27 | 2019-12-03 | Network-1 Technologies, Inc. | Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys |
US10700856B2 (en) | 2013-11-19 | 2020-06-30 | Network-1 Technologies, Inc. | Key derivation for a module using an embedded universal integrated circuit card |
US10911945B1 (en) * | 2018-11-19 | 2021-02-02 | Sprint Spectrum L.P. | Automated eUICC service profile configuration in view of operational issue with respect to eUICC service profile |
WO2021076665A1 (en) * | 2019-10-18 | 2021-04-22 | Landis+Gyr Innovations, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US20220012351A1 (en) * | 2016-04-29 | 2022-01-13 | Wells Fargo Bank, N.A. | Real-time feature level software security |
US20220046017A1 (en) * | 2014-09-25 | 2022-02-10 | Google Llc | Systems, methods, and media for authenticating multiple devices |
US11481852B2 (en) * | 2019-10-18 | 2022-10-25 | Landis+Gyr Innovations, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US11790349B2 (en) | 2019-10-18 | 2023-10-17 | Landis+Gyr Technology, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US11947711B1 (en) * | 2016-04-29 | 2024-04-02 | Wells Fargo Bank, N.A. | Real-time feature level software security |
US11973863B2 (en) | 2021-02-24 | 2024-04-30 | Network-1 Technologies, Inc. | Set of servers for “machine-to-machine” communications using public key infrastructure |
Families Citing this family (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10021077B1 (en) * | 2014-05-12 | 2018-07-10 | Google Llc | System and method for distributing and using signed send tokens |
US10498833B2 (en) | 2014-07-14 | 2019-12-03 | Sonos, Inc. | Managing application access of a media playback system |
EP3195551B1 (en) * | 2014-08-11 | 2019-04-17 | Oracle International Corporation | Method and system for managing fine-grained policies for requiring user approval of device management operations |
US9876780B2 (en) | 2014-11-21 | 2018-01-23 | Sonos, Inc. | Sharing access to a media service |
JP6812171B2 (en) * | 2016-08-29 | 2021-01-13 | キヤノン株式会社 | Network system and control method in network system |
US10372897B2 (en) * | 2016-10-20 | 2019-08-06 | Hewlett Packard Enterprise Development Lp | Encrypted capabilities stored in global memory |
CN108235821B (en) * | 2016-11-30 | 2020-05-08 | 华为技术有限公司 | Method and device for obtaining authorization file |
CN108200568B (en) * | 2017-12-26 | 2020-12-08 | 中国联合网络通信集团有限公司 | Mobile communication electronic SIM card data processing method and device |
US11184666B2 (en) | 2019-04-01 | 2021-11-23 | Sonos, Inc. | Access control techniques for media playback systems |
CN110351265A (en) * | 2019-07-02 | 2019-10-18 | 创新奇智(重庆)科技有限公司 | A kind of authentication method based on JWT, computer-readable medium and system |
Citations (27)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030079136A1 (en) * | 2001-08-21 | 2003-04-24 | Emmanuel Ericta | Security framework |
US20030084172A1 (en) * | 2001-10-29 | 2003-05-01 | Sun Microsystem, Inc., A Delaware Corporation | Identification and privacy in the World Wide Web |
US20040215964A1 (en) * | 1996-03-11 | 2004-10-28 | Doug Barlow | Configuring and managing resources on a multi-purpose integrated circuit card using a personal computer |
US20040243824A1 (en) * | 2003-05-28 | 2004-12-02 | Microsoft Corporation | Securely authorizing the performance of actions |
US20050102404A1 (en) * | 2000-10-24 | 2005-05-12 | Microsoft Corporation | System and method for restricting data transfers and managing software components of distributed computers |
US20060037063A1 (en) * | 2004-08-11 | 2006-02-16 | Clemmons Merlon O Ii | System and method for controlling network access |
US20070143826A1 (en) * | 2005-12-21 | 2007-06-21 | Sastry Manoj R | Method, apparatus and system for providing stronger authentication by extending physical presence to a remote entity |
US20070283012A1 (en) * | 2006-06-01 | 2007-12-06 | Christopher Chu | Alarm-driven access control in an enterprise network |
US20090064303A1 (en) * | 2007-08-31 | 2009-03-05 | Microsoft Corporation | Transferable restricted security tokens |
US20090077643A1 (en) * | 2007-09-19 | 2009-03-19 | Interdigital Patent Holdings, Inc. | Virtual subscriber identity module |
US20100062808A1 (en) * | 2008-08-25 | 2010-03-11 | Interdigital Patent Holdings, Inc. | Universal integrated circuit card having a virtual subscriber identity module functionality |
US20100205432A1 (en) * | 2007-09-27 | 2010-08-12 | Nxp B.V. | Method, system, trusted service manager, service provider and memory element for managing access rights for trusted applications |
US20100212004A1 (en) * | 2009-02-18 | 2010-08-19 | Nokia Corporation | Method and apparatus for providing enhanced service authorization |
US20100299744A1 (en) * | 2009-05-22 | 2010-11-25 | Eitan Mardiks | Service binding method and system |
US20110296182A1 (en) * | 2009-02-27 | 2011-12-01 | Zte Corporation | System and method for downloading application |
US8171525B1 (en) * | 2011-09-15 | 2012-05-01 | Google Inc. | Enabling users to select between secure service providers using a central trusted service manager |
US20120331292A1 (en) * | 2011-04-26 | 2012-12-27 | Haggerty David T | Electronic access client distribution apparatus and methods |
US20130097079A1 (en) * | 2011-10-18 | 2013-04-18 | Felix Bruder | Enabling payment for items using a mobile device |
US20130111546A1 (en) * | 2011-11-01 | 2013-05-02 | Michael J. Gargiulo | Systems, methods, and computer program products for managing secure elements |
US20130173736A1 (en) * | 2011-12-29 | 2013-07-04 | the Province of Ontario, Canada) | Communications system providing enhanced trusted service manager (tsm)verification features and related methods |
US20130231087A1 (en) * | 2012-03-05 | 2013-09-05 | Rogers Communications Inc. | Radio management method and system using embedded universal integrated circuit card |
US20130273889A1 (en) * | 2010-10-20 | 2013-10-17 | Markus Lobmaier | Secure element for mobile network services |
US20130340059A1 (en) * | 2012-06-19 | 2013-12-19 | At&T Mobility Ii, Llc | Apparatus and methods for selecting services of mobile network operators |
US20140011541A1 (en) * | 2012-07-06 | 2014-01-09 | Certicom Corporation | Methods And Apparatus For Use In Transferring An Assignment Of A Secure Chio Subscription Managers |
US20140140509A1 (en) * | 2012-11-16 | 2014-05-22 | At&T Mobility Ii, Llc | Methods for provisioning universal integrated circuit cards |
US20140179271A1 (en) * | 2010-12-06 | 2014-06-26 | Interdigital Patent Holdings, Inc. | Smart card with domain-trust evaluation and domain policy management functions |
US8839360B1 (en) * | 2011-10-04 | 2014-09-16 | Marvell International Ltd. | Scope-limited action-specific authorization token |
Family Cites Families (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5544246A (en) * | 1993-09-17 | 1996-08-06 | At&T Corp. | Smartcard adapted for a plurality of service providers and for remote installation of same |
WO1999000958A1 (en) | 1997-06-26 | 1999-01-07 | British Telecommunications Plc | Data communications |
GB2353623B (en) * | 1998-05-05 | 2003-01-08 | Jay Chieh Chen | Systems for electronic transactions |
US20040098715A1 (en) | 2002-08-30 | 2004-05-20 | Parixit Aghera | Over the air mobile device software management |
EP1927956A1 (en) * | 2006-11-30 | 2008-06-04 | Incard SA | Multi-applications IC Card with secure management of applications |
US8065716B2 (en) * | 2007-01-18 | 2011-11-22 | Intermec Ip Corp. | Method, system and article for dynamic authorization of access to licensed content |
EP2218244A2 (en) * | 2007-11-06 | 2010-08-18 | Gemalto SA | Sharing or reselling nfc applications among mobile communication devices |
US8676251B2 (en) | 2009-03-04 | 2014-03-18 | Lg Electronics Inc. | Dual modem device |
US9807608B2 (en) * | 2009-04-20 | 2017-10-31 | Interdigital Patent Holdings, Inc. | System of multiple domains and domain ownership |
CN101562621B (en) * | 2009-05-25 | 2013-05-22 | 阿里巴巴集团控股有限公司 | User authorization method and system and device thereof |
WO2011115407A2 (en) | 2010-03-15 | 2011-09-22 | Samsung Electronics Co., Ltd. | Method and system for secured remote provisioning of a universal integrated circuit card of a user equipment |
US8924715B2 (en) | 2010-10-28 | 2014-12-30 | Stephan V. Schell | Methods and apparatus for storage and execution of access control clients |
US8621168B2 (en) * | 2010-12-17 | 2013-12-31 | Google Inc. | Partitioning the namespace of a contactless smart card |
US8352749B2 (en) * | 2010-12-17 | 2013-01-08 | Google Inc. | Local trusted services manager for a contactless smart card |
CN102752375B (en) * | 2012-06-21 | 2015-10-28 | 惠州Tcl移动通信有限公司 | Realize the remote-operated method and system of smart card |
-
2013
- 2013-03-06 US US13/787,522 patent/US9264413B2/en not_active Expired - Fee Related
- 2013-12-06 KR KR1020157017660A patent/KR20150093737A/en not_active Application Discontinuation
- 2013-12-06 WO PCT/US2013/073648 patent/WO2014089474A1/en active Application Filing
- 2013-12-06 JP JP2015545883A patent/JP6335917B2/en not_active Expired - Fee Related
- 2013-12-06 EP EP13812357.5A patent/EP2929655A1/en not_active Withdrawn
- 2013-12-06 CN CN201380062939.4A patent/CN104823408A/en active Pending
Patent Citations (27)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040215964A1 (en) * | 1996-03-11 | 2004-10-28 | Doug Barlow | Configuring and managing resources on a multi-purpose integrated circuit card using a personal computer |
US20050102404A1 (en) * | 2000-10-24 | 2005-05-12 | Microsoft Corporation | System and method for restricting data transfers and managing software components of distributed computers |
US20030079136A1 (en) * | 2001-08-21 | 2003-04-24 | Emmanuel Ericta | Security framework |
US20030084172A1 (en) * | 2001-10-29 | 2003-05-01 | Sun Microsystem, Inc., A Delaware Corporation | Identification and privacy in the World Wide Web |
US20040243824A1 (en) * | 2003-05-28 | 2004-12-02 | Microsoft Corporation | Securely authorizing the performance of actions |
US20060037063A1 (en) * | 2004-08-11 | 2006-02-16 | Clemmons Merlon O Ii | System and method for controlling network access |
US20070143826A1 (en) * | 2005-12-21 | 2007-06-21 | Sastry Manoj R | Method, apparatus and system for providing stronger authentication by extending physical presence to a remote entity |
US20070283012A1 (en) * | 2006-06-01 | 2007-12-06 | Christopher Chu | Alarm-driven access control in an enterprise network |
US20090064303A1 (en) * | 2007-08-31 | 2009-03-05 | Microsoft Corporation | Transferable restricted security tokens |
US20090077643A1 (en) * | 2007-09-19 | 2009-03-19 | Interdigital Patent Holdings, Inc. | Virtual subscriber identity module |
US20100205432A1 (en) * | 2007-09-27 | 2010-08-12 | Nxp B.V. | Method, system, trusted service manager, service provider and memory element for managing access rights for trusted applications |
US20100062808A1 (en) * | 2008-08-25 | 2010-03-11 | Interdigital Patent Holdings, Inc. | Universal integrated circuit card having a virtual subscriber identity module functionality |
US20100212004A1 (en) * | 2009-02-18 | 2010-08-19 | Nokia Corporation | Method and apparatus for providing enhanced service authorization |
US20110296182A1 (en) * | 2009-02-27 | 2011-12-01 | Zte Corporation | System and method for downloading application |
US20100299744A1 (en) * | 2009-05-22 | 2010-11-25 | Eitan Mardiks | Service binding method and system |
US20130273889A1 (en) * | 2010-10-20 | 2013-10-17 | Markus Lobmaier | Secure element for mobile network services |
US20140179271A1 (en) * | 2010-12-06 | 2014-06-26 | Interdigital Patent Holdings, Inc. | Smart card with domain-trust evaluation and domain policy management functions |
US20120331292A1 (en) * | 2011-04-26 | 2012-12-27 | Haggerty David T | Electronic access client distribution apparatus and methods |
US8171525B1 (en) * | 2011-09-15 | 2012-05-01 | Google Inc. | Enabling users to select between secure service providers using a central trusted service manager |
US8839360B1 (en) * | 2011-10-04 | 2014-09-16 | Marvell International Ltd. | Scope-limited action-specific authorization token |
US20130097079A1 (en) * | 2011-10-18 | 2013-04-18 | Felix Bruder | Enabling payment for items using a mobile device |
US20130111546A1 (en) * | 2011-11-01 | 2013-05-02 | Michael J. Gargiulo | Systems, methods, and computer program products for managing secure elements |
US20130173736A1 (en) * | 2011-12-29 | 2013-07-04 | the Province of Ontario, Canada) | Communications system providing enhanced trusted service manager (tsm)verification features and related methods |
US20130231087A1 (en) * | 2012-03-05 | 2013-09-05 | Rogers Communications Inc. | Radio management method and system using embedded universal integrated circuit card |
US20130340059A1 (en) * | 2012-06-19 | 2013-12-19 | At&T Mobility Ii, Llc | Apparatus and methods for selecting services of mobile network operators |
US20140011541A1 (en) * | 2012-07-06 | 2014-01-09 | Certicom Corporation | Methods And Apparatus For Use In Transferring An Assignment Of A Secure Chio Subscription Managers |
US20140140509A1 (en) * | 2012-11-16 | 2014-05-22 | At&T Mobility Ii, Llc | Methods for provisioning universal integrated circuit cards |
Cited By (77)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9641656B2 (en) | 2011-10-13 | 2017-05-02 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US9277037B2 (en) | 2011-10-13 | 2016-03-01 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US10284694B2 (en) | 2011-10-13 | 2019-05-07 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US9854075B2 (en) | 2011-10-13 | 2017-12-26 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US9225813B2 (en) | 2011-10-13 | 2015-12-29 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US9294599B2 (en) | 2011-10-13 | 2016-03-22 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US10791205B2 (en) | 2011-10-13 | 2020-09-29 | The Boeing Company | Portable communication devices with accessory functions and related methods |
US20140372528A1 (en) * | 2013-06-13 | 2014-12-18 | Fujitsu Limited | Information processing system, information processing apparatus, and recording medium |
US10003461B2 (en) | 2013-09-10 | 2018-06-19 | Network-1 Technologies, Inc. | Power management and security for wireless modules in “machine-to-machine” communications |
US9596078B2 (en) | 2013-09-10 | 2017-03-14 | M2M And Iot Technologies, Llc | Set of servers for “machine-to-machine” communications using public key infrastructure |
US11283603B2 (en) | 2013-09-10 | 2022-03-22 | Network-1 Technologies, Inc. | Set of servers for “machine-to-machine” communications using public key infrastructure |
US11606204B2 (en) | 2013-09-10 | 2023-03-14 | Network-1 Technologies, Inc. | Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI) |
US10523432B2 (en) | 2013-09-10 | 2019-12-31 | Network-1 Technologies, Inc. | Power management and security for wireless modules in “machine-to-machine” communications |
US10250386B2 (en) | 2013-09-10 | 2019-04-02 | Network-1 Technologies, Inc. | Power management and security for wireless modules in “machine-to-machine” communications |
US9319223B2 (en) | 2013-09-10 | 2016-04-19 | M2M And Iot Technologies, Llc | Key derivation for a module using an embedded universal integrated circuit card |
US9350550B2 (en) | 2013-09-10 | 2016-05-24 | M2M And Iot Technologies, Llc | Power management and security for wireless modules in “machine-to-machine” communications |
US10187206B2 (en) | 2013-09-10 | 2019-01-22 | Network-1 Technologies, Inc. | Key derivation for a module using an embedded universal integrated circuit card |
US10177911B2 (en) | 2013-09-10 | 2019-01-08 | Network-1 Technologies, Inc. | Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys |
US10530575B2 (en) | 2013-09-10 | 2020-01-07 | Network-1 Technologies, Inc. | Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI) |
US9998280B2 (en) | 2013-09-10 | 2018-06-12 | Network-1 Technologies, Inc. | Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys |
US9288059B2 (en) | 2013-09-10 | 2016-03-15 | M2M And Iot Technologies, Llc | Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys |
US10652017B2 (en) | 2013-09-10 | 2020-05-12 | Network-1 Technologies, Inc. | Set of servers for “machine-to-machine” communications using public key infrastructure |
US9300473B2 (en) | 2013-09-10 | 2016-03-29 | M2M And Iot Technologies, Llc | Module for “machine-to-machine” communications using public key infrastructure |
US9698981B2 (en) | 2013-09-10 | 2017-07-04 | M2M And Iot Technologies, Llc | Power management and security for wireless modules in “machine-to-machine” communications |
US9742562B2 (en) | 2013-09-10 | 2017-08-22 | M2M And Iot Technologies, Llc | Key derivation for a module using an embedded universal integrated circuit card |
US9276740B2 (en) | 2013-09-10 | 2016-03-01 | M2M And Iot Technologies, Llc | Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI) |
US10057059B2 (en) | 2013-09-10 | 2018-08-21 | Network-1 Technologies, Inc. | Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI) |
US9641327B2 (en) | 2013-09-10 | 2017-05-02 | M2M And Iot Technologies, Llc | Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI) |
US9998281B2 (en) | 2013-09-10 | 2018-06-12 | Network-1 Technologies, Inc. | Set of servers for “machine-to-machine” communications using public key infrastructure |
US9819661B2 (en) * | 2013-09-12 | 2017-11-14 | The Boeing Company | Method of authorizing an operation to be performed on a targeted computing device |
US10244578B2 (en) | 2013-09-12 | 2019-03-26 | The Boeing Company | Mobile communication device and method of operating thereof |
US20150074764A1 (en) * | 2013-09-12 | 2015-03-12 | The Boeing Company | Method of authorizing an operation to be performed on a targeted computing device |
US9497221B2 (en) | 2013-09-12 | 2016-11-15 | The Boeing Company | Mobile communication device and method of operating thereof |
US10064240B2 (en) | 2013-09-12 | 2018-08-28 | The Boeing Company | Mobile communication device and method of operating thereof |
US10498530B2 (en) | 2013-09-27 | 2019-12-03 | Network-1 Technologies, Inc. | Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys |
US9100175B2 (en) * | 2013-11-19 | 2015-08-04 | M2M And Iot Technologies, Llc | Embedded universal integrated circuit card supporting two-factor authentication |
US10594679B2 (en) | 2013-11-19 | 2020-03-17 | Network-1 Technologies, Inc. | Network supporting two-factor authentication for modules with embedded universal integrated circuit cards |
US20150350219A1 (en) * | 2013-11-19 | 2015-12-03 | Telefonaktiebolaget L M Ericsson (Publ) | Profile change management |
US10700856B2 (en) | 2013-11-19 | 2020-06-30 | Network-1 Technologies, Inc. | Key derivation for a module using an embedded universal integrated circuit card |
US9351162B2 (en) | 2013-11-19 | 2016-05-24 | M2M And Iot Technologies, Llc | Network supporting two-factor authentication for modules with embedded universal integrated circuit cards |
US9961060B2 (en) | 2013-11-19 | 2018-05-01 | Network-1 Technologies, Inc. | Embedded universal integrated circuit card supporting two-factor authentication |
US11082218B2 (en) | 2013-11-19 | 2021-08-03 | Network-1 Technologies, Inc. | Key derivation for a module using an embedded universal integrated circuit card |
US20150163056A1 (en) * | 2013-11-19 | 2015-06-11 | John A. Nix | Embedded Universal Integrated Circuit Card Supporting Two-Factor Authentication |
US10362012B2 (en) | 2013-11-19 | 2019-07-23 | Network-1 Technologies, Inc. | Network supporting two-factor authentication for modules with embedded universal integrated circuit cards |
US20160352698A1 (en) * | 2013-12-05 | 2016-12-01 | Huawei Device Co., Ltd. | Security control method for euicc and euicc |
US11916893B2 (en) | 2013-12-06 | 2024-02-27 | Network-1 Technologies, Inc. | Embedded universal integrated circuit card supporting two-factor authentication |
US10382422B2 (en) | 2013-12-06 | 2019-08-13 | Network-1 Technologies, Inc. | Embedded universal integrated circuit card supporting two-factor authentication |
US10084768B2 (en) | 2013-12-06 | 2018-09-25 | Network-1 Technologies, Inc. | Embedded universal integrated circuit card supporting two-factor authentication |
US11233780B2 (en) | 2013-12-06 | 2022-01-25 | Network-1 Technologies, Inc. | Embedded universal integrated circuit card supporting two-factor authentication |
US9628976B2 (en) | 2014-06-23 | 2017-04-18 | Samsung Electronics Co., Ltd. | Method and apparatus for optimizing internet communications |
US10116456B2 (en) | 2014-06-23 | 2018-10-30 | Samsung Electronics Co., Ltd. | Method and apparatus for optimizing internet communications |
WO2015199319A1 (en) * | 2014-06-23 | 2015-12-30 | Samsung Electronics Co., Ltd. | Method and apparatus for optimizing internet communications |
CN105282729A (en) * | 2014-06-23 | 2016-01-27 | 三星电子株式会社 | Method and apparatus for optimizing internet communications |
US10476671B2 (en) | 2014-07-17 | 2019-11-12 | Samsung Electronics Co., Ltd. | Method and device for installing profile of eUICC |
US11637829B2 (en) * | 2014-09-25 | 2023-04-25 | Google Llc | Systems, methods, and media for authenticating multiple devices |
US20220046017A1 (en) * | 2014-09-25 | 2022-02-10 | Google Llc | Systems, methods, and media for authenticating multiple devices |
US20160098616A1 (en) * | 2014-10-02 | 2016-04-07 | Facebook, Inc. | Techniques for managing discussion sharing on a mobile platform |
US10560418B2 (en) * | 2014-10-02 | 2020-02-11 | Facebook, Inc. | Techniques for managing discussion sharing on a mobile platform |
US10778682B1 (en) | 2015-01-26 | 2020-09-15 | Winklevoss Ip, Llc | Authenticating a user device associated with a user to communicate via a wireless network in a secure web-based environment |
US10484376B1 (en) | 2015-01-26 | 2019-11-19 | Winklevoss Ip, Llc | Authenticating a user device associated with a user to communicate via a wireless network in a secure web-based environment |
US11283797B2 (en) | 2015-01-26 | 2022-03-22 | Gemini Ip, Llc | Authenticating a user device associated with a user to communicate via a wireless network in a secure web-based environment |
US11947711B1 (en) * | 2016-04-29 | 2024-04-02 | Wells Fargo Bank, N.A. | Real-time feature level software security |
US11947710B2 (en) * | 2016-04-29 | 2024-04-02 | Wells Fargo Bank, N.A. | Real-time feature level software security |
US20220012351A1 (en) * | 2016-04-29 | 2022-01-13 | Wells Fargo Bank, N.A. | Real-time feature level software security |
US11388588B2 (en) * | 2016-05-13 | 2022-07-12 | Nokia Solutions And Networks Oy | Optimized small data transmission over uplink |
WO2017196360A1 (en) * | 2016-05-13 | 2017-11-16 | Nokia Solutions And Networks Oy | Optimized small data transmission over uplink |
US20180278607A1 (en) * | 2017-03-22 | 2018-09-27 | Amazon Technologies, Inc. | Device Credentials Management |
CN111345052A (en) * | 2017-12-18 | 2020-06-26 | 康维达无线有限责任公司 | Method for enabling context-aware authorization of data or services in the IOT/M2M service layer |
WO2019126185A1 (en) * | 2017-12-18 | 2019-06-27 | Convida Wireless, Llc | Methods to enable context aware authorization for data or services in the iot/m2m service layer |
US11765586B2 (en) | 2017-12-18 | 2023-09-19 | Convida Wireless, Llc | Context aware authorization for data and services in the IoT/M2M service layer |
US10911945B1 (en) * | 2018-11-19 | 2021-02-02 | Sprint Spectrum L.P. | Automated eUICC service profile configuration in view of operational issue with respect to eUICC service profile |
US11481852B2 (en) * | 2019-10-18 | 2022-10-25 | Landis+Gyr Innovations, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US11481851B2 (en) | 2019-10-18 | 2022-10-25 | Landis+Gyr Innovations, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US11790349B2 (en) | 2019-10-18 | 2023-10-17 | Landis+Gyr Technology, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US11915330B2 (en) | 2019-10-18 | 2024-02-27 | Landis+Gyr Technology, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
WO2021076665A1 (en) * | 2019-10-18 | 2021-04-22 | Landis+Gyr Innovations, Inc. | Secure tokens for controlling access to a resource in a resource distribution network |
US11973863B2 (en) | 2021-02-24 | 2024-04-30 | Network-1 Technologies, Inc. | Set of servers for “machine-to-machine” communications using public key infrastructure |
Also Published As
Publication number | Publication date |
---|---|
EP2929655A1 (en) | 2015-10-14 |
JP2016500491A (en) | 2016-01-12 |
JP6335917B2 (en) | 2018-05-30 |
CN104823408A (en) | 2015-08-05 |
US9264413B2 (en) | 2016-02-16 |
WO2014089474A1 (en) | 2014-06-12 |
KR20150093737A (en) | 2015-08-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9264413B2 (en) | Management of network devices utilizing an authorization token | |
US11258781B2 (en) | Context and device state driven authorization for devices | |
US20180091978A1 (en) | Universal Integrated Circuit Card Having A Virtual Subscriber Identity Module Functionality | |
CN107547571B (en) | Method for managing access control and access control client provisioning server | |
KR102284954B1 (en) | Method and apparatus for downloading a profile in a wireless communication system | |
TWI469654B (en) | Methods and apparatus for delivering electronic identification components over a wireless network | |
US9043898B2 (en) | Access management system | |
US10084788B2 (en) | Peer to peer enterprise file sharing | |
JP2015512209A (en) | Mobile device supporting multiple access control clients and corresponding method | |
CN104541279A (en) | Mobile platform with sensor data security | |
US20150020180A1 (en) | Wireless two-factor authentication, authorization and audit system with close proximity between mass storage device and communication device | |
US11563730B2 (en) | Method and electronic device for managing digital keys | |
US9584508B2 (en) | Peer to peer enterprise file sharing | |
US9571288B2 (en) | Peer to peer enterprise file sharing | |
US10803206B2 (en) | Wireless enabled secure storage drive | |
US20180152307A1 (en) | Device to provide trusted time assurance | |
US9473482B2 (en) | Push-based trust model for public cloud applications | |
US9445266B2 (en) | Smart plug or cradle | |
US20230033931A1 (en) | Method, ledger and system for establishing a secure connection from a chip to a network and corresponding network | |
WO2023000719A1 (en) | Terminal access method, equipment and terminal |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: QUALCOMM INCORPORATED, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ZHANG, JIANG;REEL/FRAME:030941/0900 Effective date: 20130311 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |
|
FEPP | Fee payment procedure |
Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
LAPS | Lapse for failure to pay maintenance fees |
Free format text: PATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
FP | Lapsed due to failure to pay maintenance fee |
Effective date: 20240216 |